<html>
<head>
<title>Malware Analysis</title>
<style type="text/css">
    span.foldopened { color: white; font-size: xx-small;
    border-width: 1; font-family: monospace; padding: 0em 0.25em 0em 0.25em; background: #e0e0e0;
    VISIBILITY: visible;
    cursor:pointer; }


    span.foldclosed { color: #666666; font-size: xx-small;
    border-width: 1; font-family: monospace; padding: 0em 0.25em 0em 0.25em; background: #e0e0e0;
    VISIBILITY: hidden;
    cursor:pointer; }

    span.foldspecial { color: #666666; font-size: xx-small; border-style: none solid solid none;
    border-color: #CCCCCC; border-width: 1; font-family: sans-serif; padding: 0em 0.1em 0em 0.1em; background: #e0e0e0;
    cursor:pointer; }

    li { list-style: none; }

    span.l { color: red; font-weight: bold; }

    a:link {text-decoration: none; color: black; }
    a:visited {text-decoration: none; color: black; }
    a:active {text-decoration: none; color: black; }
    a:hover {text-decoration: none; color: black; background: #eeeee0; }

</style>
<!-- ^ Position is not set to relative / absolute here because of Mozilla -->
</head>
<body>

<script language="JavaScript">
   // Here we implement folding. It works fine with MSIE5.5, MSIE6.0 and
   // Mozilla 0.9.6.

   if (document.layers) {
      //Netscape 4 specific code
      pre = 'document.';
      post = ''; }
   if (document.getElementById) {
      //Netscape 6 specific code
      pre = 'document.getElementById("';
      post = '").style'; }
   if (document.all) {
      //IE4+ specific code
      pre = 'document.all.';
      post = '.style'; }

function layer_exists(layer) {
   try {
      eval(pre + layer + post);
      return true; }
   catch (error) {
      return false; }}

function show_layer(layer) {
   eval(pre + layer + post).position = 'relative'; 
   eval(pre + layer + post).visibility = 'visible'; }

function hide_layer(layer) {
   eval(pre + layer + post).visibility = 'hidden';
   eval(pre + layer + post).position = 'absolute'; }

function hide_folder(folder) {
    hide_folding_layer(folder)
    show_layer('show'+folder);

    scrollBy(0,0); // This is a work around to make it work in Browsers (Explorer, Mozilla)
}

function show_folder(folder) {
    // Precondition: all subfolders are folded

    show_layer('hide'+folder);
    hide_layer('show'+folder);
    show_layer('fold'+folder);

    scrollBy(0,0); // This is a work around to make it work in Browsers (Explorer, Mozilla)

    var i;
    for (i=1; layer_exists('fold'+folder+'_'+i); ++i) {
       show_layer('show'+folder+'_'+i); }
}
function show_folder_completely(folder) {
    // Precondition: all subfolders are folded

    show_layer('hide'+folder);
    hide_layer('show'+folder);
    show_layer('fold'+folder);

    scrollBy(0,0); // This is a work around to make it work in Browsers (Explorer, Mozilla)

    var i;
    for (i=1; layer_exists('fold'+folder+'_'+i); ++i) {
       show_folder_completely(folder+'_'+i); }
}



function hide_folding_layer(folder) {
   var i;
   for (i=1; layer_exists('fold'+folder+'_'+i); ++i) {
       hide_folding_layer(folder+'_'+i); }

   hide_layer('hide'+folder);
   hide_layer('show'+folder);
   hide_layer('fold'+folder);

   scrollBy(0,0); // This is a work around to make it work in Browsers (Explorer, Mozilla)
}

function fold_document() {
   var i;
   var folder = '1';
   for (i=1; layer_exists('fold'+folder+'_'+i); ++i) {
       hide_folder(folder+'_'+i); }
}

function unfold_document() {
   var i;
   var folder = '1';
   for (i=1; layer_exists('fold'+folder+'_'+i); ++i) {
       show_folder_completely(folder+'_'+i); }
}

</script>
<SPAN class=foldspecial onclick="fold_document()">All +</SPAN>
<SPAN class=foldspecial onclick="unfold_document()">All -</SPAN>
<p>Malware Analysis
<ul><li><span id="show1_1" class="foldclosed" onClick="show_folder('1_1')" style="POSITION: absolute">+</span> <span id="hide1_1" class="foldopened" onClick="hide_folder('1_1')">-</Span>
Trivial Analysis
<ul id="fold1_1" style="POSITION: relative; VISIBILITY: visible;"><li>Imports

</li>
<li>Strings

</li>

</ul>
</li>
<li><span id="show1_2" class="foldclosed" onClick="show_folder('1_2')" style="POSITION: absolute">+</span> <span id="hide1_2" class="foldopened" onClick="hide_folder('1_2')">-</Span>
Live Analysis
<ul id="fold1_2" style="POSITION: relative; VISIBILITY: visible;"><li>Regmon

</li>
<li>Filemon

</li>
<li>TCPView

</li>
<li>InCtrl

</li>
<li>SysAnalyzer

</li>
<li>Etc...

</li>

</ul>
</li>
<li><span id="show1_3" class="foldclosed" onClick="show_folder('1_3')" style="POSITION: absolute">+</span> <span id="hide1_3" class="foldopened" onClick="hide_folder('1_3')">-</Span>
Unpacking
<ul id="fold1_3" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_3_1" class="foldclosed" onClick="show_folder('1_3_1')" style="POSITION: absolute">+</span> <span id="hide1_3_1" class="foldopened" onClick="hide_folder('1_3_1')">-</Span>
Dumping
<ul id="fold1_3_1" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_3_1_1" class="foldclosed" onClick="show_folder('1_3_1_1')" style="POSITION: absolute">+</span> <span id="hide1_3_1_1" class="foldopened" onClick="hide_folder('1_3_1_1')">-</Span>
OllyDump
<ul id="fold1_3_1_1" style="POSITION: relative; VISIBILITY: visible;"><li>Execute the target process in OllyDbg

</li>
<li>Either single step to the control transfer or simply let the application run

</li>
<li>Select OllyDump from the plugins menu

</li>
<li>Select dump

</li>
<li>Optionally select one of two IAT rebuilding methods

</li>
<li>Look into rebuilding the IAT if you did not select a rebuild method

</li>

</ul>
</li>
<li><span id="show1_3_1_2" class="foldclosed" onClick="show_folder('1_3_1_2')" style="POSITION: absolute">+</span> <span id="hide1_3_1_2" class="foldopened" onClick="hide_folder('1_3_1_2')">-</Span>
ProcDump
<ul id="fold1_3_1_2" style="POSITION: relative; VISIBILITY: visible;"><li>Launch the target process on it's own

</li>
<li>Have ProcDump create a dump

</li>
<li>Look into rebuilding the IAT

</li>

</ul>
</li>
<li>Etc.

</li>

</ul>
</li>
<li><span id="show1_3_2" class="foldclosed" onClick="show_folder('1_3_2')" style="POSITION: absolute">+</span> <span id="hide1_3_2" class="foldopened" onClick="hide_folder('1_3_2')">-</Span>
IAT Fixing / Symbol Creation
<ul id="fold1_3_2" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_3_2_1" class="foldclosed" onClick="show_folder('1_3_2_1')" style="POSITION: absolute">+</span> <span id="hide1_3_2_1" class="foldopened" onClick="hide_folder('1_3_2_1')">-</Span>
OllyDump
<ul id="fold1_3_2_1" style="POSITION: relative; VISIBILITY: visible;"><li>Execute the target process in OllyDbg

</li>
<li>Either single step to the control transfer or simply let the application run

</li>
<li>Select OllyDump from the plugins menu

</li>
<li>Select dump

</li>
<li>Select one of two IAT rebuild methods

</li>
<li>Load dump in IDA

</li>

</ul>
</li>
<li><span id="show1_3_2_2" class="foldclosed" onClick="show_folder('1_3_2_2')" style="POSITION: absolute">+</span> <span id="hide1_3_2_2" class="foldopened" onClick="hide_folder('1_3_2_2')">-</Span>
ImportRec
<ul id="fold1_3_2_2" style="POSITION: relative; VISIBILITY: visible;"><li>Create a dump file

</li>
<li>Launch the process on it's own and let it run

</li>
<li>Launch ImportRec

</li>
<li>Select the target process

</li>
<li>Press "IAT Autoscan"

</li>
<li>If nothing was found, increase the size and search again

</li>
<li>Manually remove garbage thunks

</li>
<li>Press "fix dump"

</li>
<li>Select the target dump

</li>
<li>Load in IDA to verify results

</li>

</ul>
</li>
<li><span id="show1_3_2_3" class="foldclosed" onClick="show_folder('1_3_2_3')" style="POSITION: absolute">+</span> <span id="hide1_3_2_3" class="foldopened" onClick="hide_folder('1_3_2_3')">-</Span>
IDCDumpFix
<ul id="fold1_3_2_3" style="POSITION: relative; VISIBILITY: visible;"><li>Create a dump file

</li>
<li>Start target application in OllyDbg

</li>
<li>Press F9 to let it run

</li>
<li>Press Alt+M and locate the code page

</li>
<li>Follow in disassembler

</li>
<li>Alt+A to analyze

</li>
<li>Right click and select Search -&gt; all intermodular calls

</li>
<li>Copy paste the entire table to IDCDumpFix

</li>
<li>Convert to IDC

</li>
<li>Run in IDA over dumped file

</li>
<li>You won't get an IAT using this technique, but you will get usable symbols

</li>
<li>(watch for an increase in the "names" list)

</li>

</ul>
</li>

</ul>
</li>
<li><span id="show1_3_3" class="foldclosed" onClick="show_folder('1_3_3')" style="POSITION: absolute">+</span> <span id="hide1_3_3" class="foldopened" onClick="hide_folder('1_3_3')">-</Span>
Emulation
<ul id="fold1_3_3" style="POSITION: relative; VISIBILITY: visible;"><li>Load target in IDA

</li>
<li>Launch IDA-x86-emu plug-in

</li>
<li>Click "push data"

</li>
<li>Enter "0 0 0 0 0 0 0 ...." to create some stack space

</li>
<li>Copy the value of ESP to EBP

</li>
<li>You are now ready to start using the plug-in

</li>

</ul>
</li>

</ul>
</li>
<li><span id="show1_4" class="foldclosed" onClick="show_folder('1_4')" style="POSITION: absolute">+</span> <span id="hide1_4" class="foldopened" onClick="hide_folder('1_4')">-</Span>
Reverse Engineering
<ul id="fold1_4" style="POSITION: relative; VISIBILITY: visible;"><li>Identify if malware is a variant

</li>
<li>Call graph + naming analysis

</li>
<li>Quickly scan through binary naming obvious functions

</li>
<li>Utilize the keyboard shortcuts to speed the process

</li>
<li>The custom tagging routines we created are helpful

</li>
<li>String decoding if necessary

</li>
<li>Back trace interesting string and API cross references

</li>
<li><span id="show1_4_1" class="foldclosed" onClick="show_folder('1_4_1')" style="POSITION: absolute">+</span> <span id="hide1_4_1" class="foldopened" onClick="hide_folder('1_4_1')">-</Span>
Look for answers to specific questions
<ul id="fold1_4_1" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_4_1_1" class="foldclosed" onClick="show_folder('1_4_1_1')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1" class="foldopened" onClick="hide_folder('1_4_1_1')">-</Span>
How is it spreading?
<ul id="fold1_4_1_1" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_4_1_1_1" class="foldclosed" onClick="show_folder('1_4_1_1_1')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_1" class="foldopened" onClick="hide_folder('1_4_1_1_1')">-</Span>
If over IP how fast?
<ul id="fold1_4_1_1_1" style="POSITION: relative; VISIBILITY: visible;"><li>connect()

</li>
<li>send()

</li>
<li>sendto()

</li>
<li>CreateThread()

</li>
<li>Sleep()

</li>

</ul>
</li>
<li><span id="show1_4_1_1_2" class="foldclosed" onClick="show_folder('1_4_1_1_2')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_2" class="foldopened" onClick="hide_folder('1_4_1_1_2')">-</Span>
Is the prand() biased?
<ul id="fold1_4_1_1_2" style="POSITION: relative; VISIBILITY: visible;"><li>GetTickCount()

</li>
<li>rand() ;-)

</li>

</ul>
</li>
<li><span id="show1_4_1_1_3" class="foldclosed" onClick="show_folder('1_4_1_1_3')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_3" class="foldopened" onClick="hide_folder('1_4_1_1_3')">-</Span>
Does it contain a mass mailer?
<ul id="fold1_4_1_1_3" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_4_1_1_3_1" class="foldclosed" onClick="show_folder('1_4_1_1_3_1')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_3_1" class="foldopened" onClick="hide_folder('1_4_1_1_3_1')">-</Span>
harvesting e-mails
<ul id="fold1_4_1_1_3_1" style="POSITION: relative; VISIBILITY: visible;"><li>FindFirstFile()

</li>
<li>FindNextFile()

</li>
<li>MapViewOfFile()

</li>
<li>CreateFile()

</li>
<li>CreateFileMapping()

</li>

</ul>
</li>
<li><span id="show1_4_1_1_3_2" class="foldclosed" onClick="show_folder('1_4_1_1_3_2')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_3_2" class="foldopened" onClick="hide_folder('1_4_1_1_3_2')">-</Span>
SMTP engine
<ul id="fold1_4_1_1_3_2" style="POSITION: relative; VISIBILITY: visible;"><li>htons(25) / htons(0x19)

</li>

</ul>
</li>
<li><span id="show1_4_1_1_3_3" class="foldclosed" onClick="show_folder('1_4_1_1_3_3')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_3_3" class="foldopened" onClick="hide_folder('1_4_1_1_3_3')">-</Span>
SMTP discovery
<ul id="fold1_4_1_1_3_3" style="POSITION: relative; VISIBILITY: visible;"><li>RegQueryValue(Software\Microsoft\Internet Account Manager\Accounts\SMTP Server)

</li>

</ul>
</li>

</ul>
</li>
<li><span id="show1_4_1_1_4" class="foldclosed" onClick="show_folder('1_4_1_1_4')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_4" class="foldopened" onClick="hide_folder('1_4_1_1_4')">-</Span>
Does it spread over network shares?
<ul id="fold1_4_1_1_4" style="POSITION: relative; VISIBILITY: visible;"><li>WNetOpenEnum()

</li>
<li>WNetEnumResource()

</li>
<li>&nbsp;

</li>

</ul>
</li>
<li><span id="show1_4_1_1_5" class="foldclosed" onClick="show_folder('1_4_1_1_5')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_5" class="foldopened" onClick="hide_folder('1_4_1_1_5')">-</Span>
Does it spread over P2P?
<ul id="fold1_4_1_1_5" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_4_1_1_5_1" class="foldclosed" onClick="show_folder('1_4_1_1_5_1')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_5_1" class="foldopened" onClick="hide_folder('1_4_1_1_5_1')">-</Span>
kazaa
<ul id="fold1_4_1_1_5_1" style="POSITION: relative; VISIBILITY: visible;"><li>RegQueryValue(Software\\Kazaa\\Transfer)

</li>

</ul>
</li>

</ul>
</li>
<li><span id="show1_4_1_1_6" class="foldclosed" onClick="show_folder('1_4_1_1_6')" style="POSITION: absolute">+</span> <span id="hide1_4_1_1_6" class="foldopened" onClick="hide_folder('1_4_1_1_6')">-</Span>
Does it spread over an exploit?
<ul id="fold1_4_1_1_6" style="POSITION: relative; VISIBILITY: visible;"><li>connect()

</li>
<li>send()

</li>
<li>sendto()

</li>

</ul>
</li>

</ul>
</li>
<li><span id="show1_4_1_2" class="foldclosed" onClick="show_folder('1_4_1_2')" style="POSITION: absolute">+</span> <span id="hide1_4_1_2" class="foldopened" onClick="hide_folder('1_4_1_2')">-</Span>
Does it contain a backdoor?
<ul id="fold1_4_1_2" style="POSITION: relative; VISIBILITY: visible;"><li>Does it connect to an IRC server?

</li>
<li><span id="show1_4_1_2_1" class="foldclosed" onClick="show_folder('1_4_1_2_1')" style="POSITION: absolute">+</span> <span id="hide1_4_1_2_1" class="foldopened" onClick="hide_folder('1_4_1_2_1')">-</Span>
Does it bind to any ports?
<ul id="fold1_4_1_2_1" style="POSITION: relative; VISIBILITY: visible;"><li>bind()

</li>
<li>accept()

</li>
<li>listen()

</li>

</ul>
</li>

</ul>
</li>
<li><span id="show1_4_1_3" class="foldclosed" onClick="show_folder('1_4_1_3')" style="POSITION: absolute">+</span> <span id="hide1_4_1_3" class="foldopened" onClick="hide_folder('1_4_1_3')">-</Span>
What modifications are made?
<ul id="fold1_4_1_3" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_4_1_3_1" class="foldclosed" onClick="show_folder('1_4_1_3_1')" style="POSITION: absolute">+</span> <span id="hide1_4_1_3_1" class="foldopened" onClick="hide_folder('1_4_1_3_1')">-</Span>
Does it touch any registery keys?
<ul id="fold1_4_1_3_1" style="POSITION: relative; VISIBILITY: visible;"><li>RegOpenKey()

</li>
<li>RegCreateKey()

</li>
<li>RegSetValue()

</li>

</ul>
</li>
<li>Does it touch any files?

</li>
<li><span id="show1_4_1_3_2" class="foldclosed" onClick="show_folder('1_4_1_3_2')" style="POSITION: absolute">+</span> <span id="hide1_4_1_3_2" class="foldopened" onClick="hide_folder('1_4_1_3_2')">-</Span>
Does it touch any processes?
<ul id="fold1_4_1_3_2" style="POSITION: relative; VISIBILITY: visible;"><li>OpenProcess()

</li>
<li>WriteProcessMemory()

</li>
<li>CreateRemoteThread()

</li>

</ul>
</li>
<li>Does it touch itself? (hehe)

</li>

</ul>
</li>
<li><span id="show1_4_1_4" class="foldclosed" onClick="show_folder('1_4_1_4')" style="POSITION: absolute">+</span> <span id="hide1_4_1_4" class="foldopened" onClick="hide_folder('1_4_1_4')">-</Span>
Are there any special dates?
<ul id="fold1_4_1_4" style="POSITION: relative; VISIBILITY: visible;"><li><span id="show1_4_1_4_1" class="foldclosed" onClick="show_folder('1_4_1_4_1')" style="POSITION: absolute">+</span> <span id="hide1_4_1_4_1" class="foldopened" onClick="hide_folder('1_4_1_4_1')">-</Span>
Is there an expiration date?
<ul id="fold1_4_1_4_1" style="POSITION: relative; VISIBILITY: visible;"><li>GetSystemTimeAsFileTime()

</li>
<li>SystemTimeToFileTime()

</li>
<li>FileTimeToLocalFileTime()

</li>

</ul>
</li>
<li>Is there a destruction date?

</li>

</ul>
</li>

</ul>
</li>
<li><span id="show1_4_2" class="foldclosed" onClick="show_folder('1_4_2')" style="POSITION: absolute">+</span> <span id="hide1_4_2" class="foldopened" onClick="hide_folder('1_4_2')">-</Span>
Emulation
<ul id="fold1_4_2" style="POSITION: relative; VISIBILITY: visible;"><li>Load target in IDA

</li>
<li>Launch IDA-x86-emu plug-in

</li>
<li>Click "push data"

</li>
<li>Enter "0 0 0 0 0 0 0 ...." to create some stack space

</li>
<li>Copy the value of ESP to EBP

</li>
<li>You are now ready to start using the plug-in

</li>

</ul>
</li>

</ul>
</li>

</ul><SCRIPT language=JavaScript>
fold_document();
</SCRIPT>
</body>
</html>
